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We claim: 



1 1. An on-line method of classifying IP addresses into related clusters within a distributed 

2 information network, the method comprising the steps of: 

3 receiving a plurality of IP addresses; 

4 processing the plurality of IP addresses according to a radix encoded trie classification 

5 process; and 

6 classifying the plurality of IP addresses into related clusters. 

1 2. The method of claim 1, wherein the plurality of client IP addresses are received from one 



2 or more network routers. 



"4 3. The method of claim 1, wherein the IP addresses are network client IP addresses. 

i]i 

4. The method of claim 1, wherein the distributed information network is the World Wide 

if2 Web. 

i; 

'^1 5. A method for on-line grouping of a plurality of Web client IP addresses into related client 

Ui2 clusters, the method comprising the steps of: 

□ 

j-^j3 extracting chent IP addresses from a collection of IP addresses; 

4 performing longest prefix matching on each client IP address; and 

5 classifying all of the client IP addresses that have the same longest matched prefix into a 

6 client cluster based on a radix encoded trie matching process. 

1 6. The method of claim 1, wherein the client IP addresses are extracted in real time from a 

2 network server, 

1 7. The method of claim 1, wherein the distributed information network is the Internet. 
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1 8. A method for determining the relationships between a plurality of client IP addresses, the 

2 method comprising: 

3 processing the plurality of client IP addresses according to a radix encoding trie (retrie); 

4 and 

5 grouping all of the client IP addresses which share the common longest prefix matching 

6 into at least one client IP grouping. 

7 

1 9. The method of claim 8, further comprising: 

2 receiving the plurality of client EP addresses from one or more network servers. 

3 

3 10. The method of claim 8, wherein the network servers are at least one of proxy servers, 



-4 cache servers, content distribution servers and mirror servers. 

D 

'^l 1 1 . The method of claim 8, wherein the at least one IP address is a chent IP address. 

I J. 12. The method of claim 8, wherein the at least one IP address is a server IP address, wherein 

'"^ the cluster is a server cluster. 



13. The method of claim 8, wherein the retrie includes shift, mask values which are 

2 combined into a single value in a predecessor table. 
3 

1 14. The method of claim 8, wherein the elements in a last retrie table level contain only a 

2 next hop index so as to decrease the retrie table size. 
3 

1 15. The method of claim 8, wherein the retrie includes a fixed number of retrie levels. 
2 

1 16. The method of claim 8, wherein the number of retrie levels is fixed at two levels. 
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17. A computer-readable medium containing executable instructions which cause a computer 
to perform the steps of: 

extracting at least one IP address; 

performing longest prefix matching on the at least one EP address; and 
classifying the at least one IP address into a cluster, wherein the longest prefix matching 
is performed according to a radix-encoded trie. 

18. The computer-readable medium of claim 17, wherein the at least one IP address is a 
client IP address. 

19. The computer-readable medium of claim 17, wherein the at least one IP address is a 
server IP address, wherein the cluster is a server cluster. 

20. The computer-readable mediimi of claim 17, wherein the radix encoded trie is described 
by the equation: 

while(! ((r=T— >tablel(x»r— >shift)&r— >mask] )&1) 
where x is the search key and r is the radix encode trie. 
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